6 ms·

Freedom Mobile's 4 digit password limit

44 points by Nullificus 4y ago

Nullificus 4y ago
It's clear I don't know how to handle this. I'm hoping someone here can pass it along to the correct people and have them actually listen.
UI_at_80x24 4y ago
It's clear the only way to achieve progress in the world today is 'Name & Shame'. Hell, I've got better security for my email then I can get from Canadian Banks! I'm not surprised that Freedom Mobile is so lax. I've been a customer since they were originally called "Wind" (at the time it was the only company that my N900 would work with). The only thing that they had going for them over the competition was good prices. That's barely accurate anymore. I hate all Canadian telecommunications companies.
- scohesc 4y ago
  Canadian telecoms have to be one of the most oligopolous (is that a word?) set of companies in the country. Telus, Bell, Rogers all 'competing' with each other, each of them owning several 'budget/flank' brands so they can capture even more of the individual market segments. It reminds me of tool manufacturers like Black and Decker creating (absorbing/buying out) once reputable brands that capture individual market segments (Dewalt, Craftsman, Stanley, etc.) - now it's been optimized down to cost, market capture, and quality/performance of tools. Back to cell phones - I understand there's only so much spectrum to go around which limits what companies can afford to license/purchase from the government, along with how much throughput you can throw from those frequencies - but still! I don't understand why Canadians pay so much for basic features in $/GB for example - they have some of the highest cost cellphone plans in the world!
  - klyrs 4y ago
    As somebody who uses the 'budget/flank' brands, they always start cheap but they ratchet the prices up and the features down, so after 2-3 years of using one, I'm looking for the next brand to switch to.
    - willhslade 4y ago
      I'm no shill but Mirgin Vobile during Black Friday was actually competitive this year.
      - Fire-Dragon-DoL 4y ago
        What do you mean by competitive? I haven't seen a plan at the less than 35$ except for public mobile at 25$ with 1gb. I come from Italy and at 5 you get 50 gb. The pricing is just insane
- 908B64B197 4y ago
  > Hell, I've got better security for my email then I can get from Canadian Banks At this point why not switch to a US one? > I hate all Canadian telecommunications companies. Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago.
  - voisin 4y ago
    > At this point why not switch to a US one? As a Canadian I offer two things: 1) it is a pain for people to call you and have to pay long distance every time they call. Yes, long distance to the US is still a major thing in Canada. 2) I recently moved but kept my old phone number / area code. The number of times I call people and they don’t answer but then call me back right away and say “oh I saw an Ontario number and thought it was spam” is probably 4 out of 5 calls I make. People aren’t as accepting of non-local area codes as in the US. Probably because of the ridiculous number of scam calls we get. Edit: > Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago. Because Canadian providers are in bed with the competition bureau and other regulators that essentially allow them to twist the rules to ensure the current oligopoly is permanent and allows them to charge the highest mobile rates in the world, by far. Canadian consumers by and large hate the situation but politicians don’t listen and it isn’t a big enough issue for a complacent populace to vote on.
  - BeefWellington 4y ago
    Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago. Of the major telecom providers, 3/4 of them control news media of various kinds (print, radio, television, streaming services). Politicians seem to bend the country over on behalf of these companies because if you say you're going to do anything else you get relentlessly attacked by the press. The telco regulator (CRTC) has had essentially former execs from one of the major telcos over the past thirty years except for a couple of people who actually tried to make changes. The lowest telco rates in the country are in the one province that has a provincially-owned provider: Saskatchewan. Previous governments at the federal and various provincial levels essentially de-incentivized a ton of tech investment that the country used to excel at. Nortel's story is one of espionage being their undoing and I'm not sure anyone could have done anything about that. Blackberry I think just represented a business unable to pivot fast enough when the tides shifted.
ilrwbwrkhv 4y ago
Once again the great nation of Canada and Canadian businesses show their absurd levels of mediocrity. Every single business is like this. Filled with low quality, nepotism, low ambition, zero competition and zero hope for the future.
- ec59cb1659 4y ago
  If you are competitive, ambitious, and meritocratic you're supposed to move to the USA and leave the rest of us alone to be mediocre in peace. Brain drain is the Canadian way.
ec59cb1659 4y ago
Login requires 2FA, though. Can that be bypassed?
- Nullificus 4y ago
  It's a five-digit pin you can guess at infinitely.
  - ec59cb1659 4y ago
    How? The login screen only allows 4 digit pins, and if you get it right then you have to confirm with 2FA.
    - Nullificus 4y ago
      Getting the correct phone number and pin combo is step one. That's the four digit pin. Step two is as many tries at the 2FA as you would like. The format is 0#####. It will take some time for sure, but you get to control the phone number as your prize Alternatively, the 4-digit pin is the security for their support line. You can obtain that without guessing the 2FA. Social engineering takes care of the rest.
      - ec59cb1659 4y ago
        Mobile account authorization is critical for national security because of the rampant requirement to use cellphones as 2FA / password reset for everything else, including GC Key itself. The government needs to step in. The question is what particular person in the government has the power and motivation to do so. Have you tried the CCTS? CSE? They might have some power, but the upcoming potential Cyber Security C-26 act should spell it out for them. It should be doable to find some big fish to take this on, especially since everyone is vulnerable to SIM swaps assuming every other Canadian phone company has such lax security.
        Nullificus 4y ago
        I worked with the Office of the Privacy Commissioner of Canada(OPC) on this a few years ago. I don't have credentials and that's enough for them not to take it seriously. I'm the only reason the 2FA is there. That change was the only change they would commit to. A few days ago is the first time since that I've logged into my account. I'm planning to contact the Competition Bureau tomorrow with the information. They are currently looking at Freedom's viability under a significantly less powerful company than Shaw Communications Inc.
0xbadc0de5 4y ago
Weak security sucks. However, this has been known about for years. People at Freedom Mobile know about it, customers know about it, the parent company knows about it. It's just that nobody has prioritized fixing it. Having seen the insides of several Canadian telco's security branches, it's a mixed bag. Some are better than others, but in general smaller, non-RoBelUs (Rogers, Bell, Telus) carriers tend to have atrocious (or non-existant) security. And even among the big-3, there are marked differences in their security maturity levels.
- deleted 4y ago
  [deleted]
Nullificus 4y ago
https://web.archive.org/web/20221229201428/https://null.pink/ https://web.archive.org/web/20221229201428/https://null.pink...

44 points by Nullificus 4y ago

It's clear I don't know how to handle this. I'm hoping someone here can pass it along to the correct people and have them actually listen.

UI_at_80x24 4y ago

It's clear the only way to achieve progress in the world today is 'Name & Shame'. Hell, I've got better security for my email then I can get from Canadian Banks! I'm not surprised that Freedom Mobile is so lax. I've been a customer since they were originally called "Wind" (at the time it was the only company that my N900 would work with). The only thing that they had going for them over the competition was good prices. That's barely accurate anymore. I hate all Canadian telecommunications companies.

scohesc 4y ago
Canadian telecoms have to be one of the most oligopolous (is that a word?) set of companies in the country. Telus, Bell, Rogers all 'competing' with each other, each of them owning several 'budget/flank' brands so they can capture even more of the individual market segments. It reminds me of tool manufacturers like Black and Decker creating (absorbing/buying out) once reputable brands that capture individual market segments (Dewalt, Craftsman, Stanley, etc.) - now it's been optimized down to cost, market capture, and quality/performance of tools. Back to cell phones - I understand there's only so much spectrum to go around which limits what companies can afford to license/purchase from the government, along with how much throughput you can throw from those frequencies - but still! I don't understand why Canadians pay so much for basic features in $/GB for example - they have some of the highest cost cellphone plans in the world!
- klyrs 4y ago
  As somebody who uses the 'budget/flank' brands, they always start cheap but they ratchet the prices up and the features down, so after 2-3 years of using one, I'm looking for the next brand to switch to.
  - willhslade 4y ago
    I'm no shill but Mirgin Vobile during Black Friday was actually competitive this year.
    - Fire-Dragon-DoL 4y ago
      What do you mean by competitive? I haven't seen a plan at the less than 35$ except for public mobile at 25$ with 1gb. I come from Italy and at 5 you get 50 gb. The pricing is just insane
908B64B197 4y ago
> Hell, I've got better security for my email then I can get from Canadian Banks At this point why not switch to a US one? > I hate all Canadian telecommunications companies. Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago.
- voisin 4y ago
  > At this point why not switch to a US one? As a Canadian I offer two things: 1) it is a pain for people to call you and have to pay long distance every time they call. Yes, long distance to the US is still a major thing in Canada. 2) I recently moved but kept my old phone number / area code. The number of times I call people and they don’t answer but then call me back right away and say “oh I saw an Ontario number and thought it was spam” is probably 4 out of 5 calls I make. People aren’t as accepting of non-local area codes as in the US. Probably because of the ridiculous number of scam calls we get. Edit: > Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago. Because Canadian providers are in bed with the competition bureau and other regulators that essentially allow them to twist the rules to ensure the current oligopoly is permanent and allows them to charge the highest mobile rates in the world, by far. Canadian consumers by and large hate the situation but politicians don’t listen and it isn’t a big enough issue for a complacent populace to vote on.
- BeefWellington 4y ago
  Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago. Of the major telecom providers, 3/4 of them control news media of various kinds (print, radio, television, streaming services). Politicians seem to bend the country over on behalf of these companies because if you say you're going to do anything else you get relentlessly attacked by the press. The telco regulator (CRTC) has had essentially former execs from one of the major telcos over the past thirty years except for a couple of people who actually tried to make changes. The lowest telco rates in the country are in the one province that has a provincially-owned provider: Saskatchewan. Previous governments at the federal and various provincial levels essentially de-incentivized a ton of tech investment that the country used to excel at. Nortel's story is one of espionage being their undoing and I'm not sure anyone could have done anything about that. Blackberry I think just represented a business unable to pivot fast enough when the tides shifted.

ilrwbwrkhv 4y ago

Once again the great nation of Canada and Canadian businesses show their absurd levels of mediocrity. Every single business is like this. Filled with low quality, nepotism, low ambition, zero competition and zero hope for the future.

ec59cb1659 4y ago
If you are competitive, ambitious, and meritocratic you're supposed to move to the USA and leave the rest of us alone to be mediocre in peace. Brain drain is the Canadian way.

ec59cb1659 4y ago

Nullificus 4y ago
It's a five-digit pin you can guess at infinitely.
- ec59cb1659 4y ago
  How? The login screen only allows 4 digit pins, and if you get it right then you have to confirm with 2FA.
  - Nullificus 4y ago
    Getting the correct phone number and pin combo is step one. That's the four digit pin. Step two is as many tries at the 2FA as you would like. The format is 0#####. It will take some time for sure, but you get to control the phone number as your prize Alternatively, the 4-digit pin is the security for their support line. You can obtain that without guessing the 2FA. Social engineering takes care of the rest.
    - ec59cb1659 4y ago
      Mobile account authorization is critical for national security because of the rampant requirement to use cellphones as 2FA / password reset for everything else, including GC Key itself. The government needs to step in. The question is what particular person in the government has the power and motivation to do so. Have you tried the CCTS? CSE? They might have some power, but the upcoming potential Cyber Security C-26 act should spell it out for them. It should be doable to find some big fish to take this on, especially since everyone is vulnerable to SIM swaps assuming every other Canadian phone company has such lax security.
      - Nullificus 4y ago
        I worked with the Office of the Privacy Commissioner of Canada(OPC) on this a few years ago. I don't have credentials and that's enough for them not to take it seriously. I'm the only reason the 2FA is there. That change was the only change they would commit to. A few days ago is the first time since that I've logged into my account. I'm planning to contact the Competition Bureau tomorrow with the information. They are currently looking at Freedom's viability under a significantly less powerful company than Shaw Communications Inc.

0xbadc0de5 4y ago

Weak security sucks. However, this has been known about for years. People at Freedom Mobile know about it, customers know about it, the parent company knows about it. It's just that nobody has prioritized fixing it. Having seen the insides of several Canadian telco's security branches, it's a mixed bag. Some are better than others, but in general smaller, non-RoBelUs (Rogers, Bell, Telus) carriers tend to have atrocious (or non-existant) security. And even among the big-3, there are marked differences in their security maturity levels.

deleted 4y ago
[deleted]

Nullificus 4y ago

https://web.archive.org/web/20221229201428/https://null.pink/ https://web.archive.org/web/20221229201428/https://null.pink...